30CWDesignated officers may undertake a vulnerability assessment

30CW Designated officers may undertake a vulnerability assessment

Scope (1) This section applies if: (a) an entity is the responsible entity for a system of national significance; and (b) either: (i) the Secretary has reasonable grounds to believe that if the entity were to be given a notice under subsection 30CU(1) or (2), the entity would not be capable of complying with the notice; or (ii) the entity has not complied with a notice given to the entity under subsection 30CU(1) or (2). Request (2) The Secretary may give a designated officer a written request to: (a) undertake a vulnerability assessment in relation to: (i) the system; and (ii) all types of cyber security incidents; and (b) do so within the period specified in the request. (3) The Secretary may give a designated officer a written request to: (a) undertake a vulnerability assessment in relation to: (i) the system; and (ii) one or more specified types of cyber security incidents; and (b) do so within the period specified in the request. (4) Before giving a request under subsection (2) or (3) in relation to the system of national significance, the Secretary must consult: (a) the entity; and (b) if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator. Requirement (5) If a request under subsection (2) or (3) is given to a designated officer, the Secretary may, by written notice given to the entity, require the entity to do any or all of the following things: (a) provide the designated officer with access to premises for the purposes of undertaking the vulnerability assessment; (b) provide the designated officer with access to computers for the purposes of undertaking the vulnerability assessment; (c) provide the designated officer with reasonable assistance and facilities that are reasonably necessary to allow the designated officer to undertake the vulnerability assessment. Notification of request (6) If a request under subsection (2) or (3) is given to a designated officer, the Secretary must give a copy of the request to the entity.